It is distributed under the terms of the Creative Commons Attribution 3.0 (CC-BY) License

(1)

International Journal of Modern Physics: Conference Series Vol. 33 (2014) 1460367 (8 pages)

 The Authors

DOI: 10.1142/S2010194514603676

This is an Open Access article published by World Scientific Publishing Company. It is distributed under the terms of the Creative Commons Attribution 3.0 (CC-BY) License. Further distribution of this work is permitted, provided the original work is properly cited.

Bit errors in the Kirchhoff-Law–Johnson-Noise secure key exchange

Yessica Saez, Laszlo B. Kish

Department of Electrical and Computer Engineering, Texas A&M University, College Station, Texas 77843-2128, USA

yessica.saez@neo.tamu.edu; laszlo.kish@ece.tamu.edu

Robert Mingesz, Zoltan Gingl

Department of Technical Informatics, University of Szeged, Árpád tér 2, Szeged, H-6701, Hungary

mingesz@inf.u-szeged.hu; gingl@inf.u-szeged.hu

Claes G. Granqvist

Department of Engineering Sciences, The Ångström Laboratory, Uppsala University, P.O. Box 534, SE-75121 Uppsala, Sweden

claes-goran.granqvist@angstrom.uu.se

Published 17 September 2014

We classify and analyze bit errors in the voltage and current measurement modes of the Kirchhoff- law–Johnson-noise (KLJN) secure key distribution system. In both measurement modes, the error probability decays exponentially with increasing duration of the bit sharing period (BSP) at fixed bandwidth. We also present an error mitigation strategy based on the combination of voltage- based and current-based schemes. The combination method has superior fidelity, with drastically reduced error probability compared to the former schemes, and it also shows an exponential dependence on the duration of the BSP.

Keywords: Information theoretic security; secure key distribution via wire KLJN; bit errors.

1. Introduction

This paper classifies and analyzes different types of errors,due to statistical inaccuracies in noise measurements, within the Kirchhoff-law–Johnson-noise (KLJN) system^1,2 and demonstrates a new and efficient way of removing these errors.^3,4 It is a summary of recent findings presented in Refs. 3 and 4.

We first present a brief description of the working principle of the KLJN system.^1-4 Int. J. Mod. Phys. Conf. Ser. 2014.33. Downloaded from www.worldscientific.com by 81.0.123.190 on 02/12/16. For personal use only.

(2)

1.1 The Kirchhoff-law–Johnson-noise secure key distribution

The KLJN secure key exchange has been proven to give information-theoretic security.^5,6 This key distribution scheme is based on Kirchhoff’s loop law of quasi-static electrodynamics and the fluctuation-dissipation theorem of statistical physics.^1-9 Figure 1 shows the ideal KLJN scheme.^1-4 The core channel is a wire line to which the two communicating parties, denoted “Alice” and “Bob”, connect their resistors R_A and R_B, respectively. These resistors are randomly chosen from the set

{

R R0, 1

}

, with R₀ ≠R₁, where R₀ and R₁ represent the different bit values. At the beginning of each bit sharing period (BSP), Alice and Bob—who have identical pairs of resistors—randomly select and connect one of these resistors to the wire line. Therefore there are four possible bit situations in which these two pairs of resistors can be connected to the wire line: 00, 01, 10 and 11.

Fig. 1. Outline of the core KLJN secure key exchange scheme without defense circuitry (current/voltage monitoring/comparison) against invasive (active) attacks or attacks utilizing non-ideal components and conditions. T_eff is the effective noise temperature of the Gaussian noise voltage generators, R_A, u tA( ), R_B, and u tB( ) are the resistor values and noise voltages at Alice and Bob, respectively. u tc( ) and ( )i t_c are channel noise voltage and current, respectively.

The cases when Alice and Bob use the same resistance values—i.e., the 00 and 11 situations—represent a non-secure bit exchange. The situations when Alice and Bob use different resistance values—i.e., the 01 and 10 bit situations—signify a secure bit exchange event because, according to the Second Law of Thermodynamics,^3-6 Eve cannot distinguish between them through measurements, and whenever Alice and Bob see the 01/10 situation they know that the other party has the complementary bit value, which means that they can infer the full bit arrangement. Thus a secure bit has been generated and shared.

Int. J. Mod. Phys. Conf. Ser. 2014.33. Downloaded from www.worldscientific.com by 81.0.123.190 on 02/12/16. For personal use only.

(3)

1.2. KLJN bit interpretations

Assuming ideal components/conditions, we proceed as in earlier works.^3,4 Let us assume that Alice and Bob measure the mean-square channel noise voltage and/or current amplitudes, i.e., u t_c²( ) 4kT R B_eff _|| _KLJN

τ = and/or _c²( ) 4 _eff 1 _KLJN

loop

i t kT B

R

τ = , respectively,

where k is Boltzmann’s constant, BKLJN is channel noise bandwidth,

|| _A _B/ ( _A _B)

R =R R R +R , R_loop=R_A+R_B, and _τ indicates finite-time average. Statistical errors (random fluctuations) appear due to the finite duration time τ of the BSP.^3,4

Figure 2^3,4 illustrates the three possible levels of the measured mean-square channel noise voltage and current for the 11, 01/10, and 00 bit situations. The threshold values

1,

∆ ∆₂ and ∆₃,∆₄ are used to determine the boundaries between the different interpretations of the measured mean-square channel noise voltages and currents, respectively, over the time window τ.

Fig. 2. Measured mean-square channel noise of voltage (a) and current (b). u t₁₁²( )

τ, u²_01/10( )t

τ, u t₀₀²( )

τ and

2 11( )

i t τ, i_01/10² ( )t

τ, i t₀₀²( )

τ are measured mean-square channel noise voltage and current at the 11, 01/10 and 00 bit situations, respectively. The solid lines with the quantities in represent ideal (infinite-time) averages.

For the sake of simplicity we assume R₀=R and R₁=αR,with α >>1.

The bit interpretations of the measured mean-square channel noise voltage³ and current⁴ are 00 when u_ch²(t)

τ< u₀₀²(t) + ∆₁ and i t_c²( ) i t₀₀²( ) ₄

τ > − ∆ , respectively.

The interpretations are 11 when u t_ch²( ) u t₁₁²( ) ₂

τ > − ∆ and i t_c²( ) i t₁₁²( ) ₃

τ < + ∆ ,

respectively. The secure bit situations 01/10 are interpreted as such when Int. J. Mod. Phys. Conf. Ser. 2014.33. Downloaded from www.worldscientific.com by 81.0.123.190 on 02/12/16. For personal use only.

(4)

2 2 2

00( ) 1 _ch( ) 11( ) 2

u t u t u t

+ ∆ ≤ τ ≤ − ∆ and i t₁₁²( ) ₃ i t_c²( ) i t₀₀²( ) ₄

+ ∆ ≤ τ ≤ − ∆ ,

respectively.

2. Error analysis in the KLJN system

Bit errors occur when the protocol makes incorrect bit interpretations due to statistical inaccuracies in the measured mean-square noise voltage and/or current. There are different types of errors situations, as shown in Table 1.^3,4

Table 1. Types of errors in the KLJN bit exchange scheme.

Actual Situation

00 11 01/10

Measurement Interpretation (Decision) 00 Correct (no error)

Error, removed (automatically)

Error, removed (automatically) 11

Error, removed (automatically)

Correct (no error)

Error, removed (automatically) 01/10

Error (probability?)

Correct (no error)

It is apparent that two types of errors need to be addressed: the 11==>01/10 errors—

i.e., the errors when the actual situation 11 is interpreted as the secure noise level 01/10—

and the 00==>01/10 errors occurring when the actual situation 00 is interpreted as 01/10.

Figure 3 shows a block diagram for the measurement process. The channel voltage and/or current first enter a squaring unit. For typical practical applications, the output signal is a voltage, because the squaring unit employs voltage-signal-based electronics.

Thus when measuring the current, for the sake of simplicity and without losing generality, we assume that the numerical values of the voltage correspond to the measured current.

Fig. 3 Mean-square channel noise voltage and/or current measurement process. Q and D are calibration coefficients of the squaring device to provide a Volt unit with the correct numerical value for the squaring Int. J. Mod. Phys. Conf. Ser. 2014.33. Downloaded from www.worldscientific.com by 81.0.123.190 on 02/12/16. For personal use only.

(5)

The measured mean-square channel noise voltage and/or current for the finite-time average τ have a DC and a superimposed AC component ( )µ t remaining after the finite-time average.^3,4 This averaging process can be represented as low-pass filtering with a cut-off frequency f_B ≈1/τ. The AC component ( )µ t of the finite-time average is Gaussian with high accuracy,^3,4,10 which follows from the Central Limit Theorem because τ is much larger than the correlation time for the AC component before averaging (

B KLJN

f <<B ). We estimate the error probability with the probability that ( )µ t is crossing a threshold during the time interval τ. To compute this probability, we follow a procedure that is analogous to the one in Refs. 3 and 4, specifically by using Rice’s formula^11,12 for threshold crossings.

2.1. General approach

We suppose that ∆ is the threshold value used to determine the boundaries between the different interpretations of ( )µ t over the time window τ. If we define S_AC_,_τ( )f as the power density spectrum of ( )µ t , the mean frequency of level crossing can be given as

2

2 0 ,

( ) 2exp ( )

ˆ 2ˆ f S^AC_τ f df

ν µ µ

−∆  ∞

∆ =  

 

∫

^, (1)

where _,

ˆ 0 S_AC_τ( )f df

µ=

∫

^∞ is the RMS value of ( )µ t and the threshold value ∆ is defined, for normalization purposes, as a fraction of the measured mean-square channel noise voltage and/or current, namely ∆ =ϕ Du t_c²( ) and/or ∆ =ϕ Qi t_c²( ) for 0< <ϕ 1, respectively. According to Ref. 10, the power density spectrum S_AC( )f for the AC componentof the non-averaged quantity u t_c²( ) and/or i t_c²( ) is

2 2

( ) 2 ( )(1 )

AC KLJN c 2

KLJN

S f D B S f f

= − B , for 0≤ f ≤2B_KLJN, (2) and S_AC( ) 0f = otherwise, where S f_c( ) is the power density spectrum of the mean-

square channel noise voltage and/or current.

The low-pass filtering effect of the time averaging cuts off this spectrum for f > f_B but keeps the S_AC( )f spectrum for f < f_B. Since f_B <<B_KLJN, the value of S_AC( )f within the frequency band f_B can be approximated by its maximum, so that

, ( ) (0)

AC AC

S _τ f ≈S . Therefore, by setting γ =B_KLJN / f_B one obtains that the frequency ν_↑( )∆ of unidirectional level crossings (half of the level crossing frequency predicted by Rice’s formula) is

2

( ) exp

3 4

fB ϕ γ

ν_↑ ∆ = ^⁻ ^

 . (3)

(6)

In the high-threshold situation, the errors follow Poisson statistics and thus the error probability during a time interval is equal to the expected number of errors within this interval provided this number is much less than one. Thus the probability ε in the case of

ε<<1 is

( ) 1 2

( ) exp

3 4 fB

ν ϕ γ

ε ν≈ _↑ ∆τ ≈ ^↑ ^∆ = ^⁻ ^

 . (4) 2.2. Statistical errors in the voltage and current measurement modes

In this section, the threshold values ∆₁,∆₂ and ∆₃,∆₄ have meanings that are similar to the one of the threshold value ∆ in the general approach presented above and are also defined as a fraction of the corresponding measured mean-square channel noise voltage and current, namely: ∆ =₁ β Du t₀₀²( ) for 0<β <1, ∆ =₂ δ Du t₁₁²( ) for 0< <δ 1,

2 3 λ Qi t11( )

∆ = for 0< <λ 1, and ∆ =₄ ρ Qi t₀₀² ( ) for 0< <ρ 1.

Substituting ∆₁ or ∆² in Eq. (4), we find that the probabilities ε₀₀ and ε₁₁ of the 00==>01/10 and 11==>01/10 types of errors in voltage measurements³ for ε₀₀<<1 are

₀₀ ( )¹ 1 ²

exp 4

3 fB

ν β γ

ε ≈ ^↑ ^∆ = ^⁻ ^

 , for 0<β<1, (5)

2 2

11

( ) 1

exp 4

B 3 f

ν δ γ

ε ≈ ^↓ ^∆ = ^⁻ ^

 , for 0< <δ 1, (6) respectively.

Similarly, by substituting ∆₃ and ∆⁴ in Eq. (4) we find that the error probabilities

,11

εi and ε_i_,00 of the 11==>01/10 and 00==>01/10 types of errors in current measurements⁴ are

2 3

,11

( ) 1

exp 4

i 3 fB

ν λ γ

ε ≈ ^↑ ^∆ = ^⁻ ^

 , for 0< <λ 1, (7)

2 4

,00

( ) 1

exp 4

i 3 fB

ν ρ γ

ε ≈ ^↓ ^∆ = ^⁻ ^

 , for 0<ρ <1, (8) respectively.

It should be noticed that—for both the voltage-based and the current-based methods—the error probabilities are exponential functions of the parameter γ, which shows that the error probability decays exponentially with increasing magnitude of τ . 2.3. Illustration of the results with practical parameters

To demonstrate the results, we assign practical values to the parameters in Eq. (4). For γ =100 and ϕ =_0.5, the bit error probability is ε=0.001. Increasing γ by a factor of two (and analogously the time average window τ ) results in ε ≈10⁻⁶, which is satisfactory for many applications.

(7)

In our case of α>>1 the mean square noise current level at 11 is much closer to the value at 01/10 than to the value at 00 (cf. Fig. 2), and hence ε_i_,00<< ε_i_,11. This situation is reversed for the case of the voltage-based method, where ε₀₀>>ε11.

2.4. A combined current–voltage error removal strategy We assume that Alice and Bob measure both u_c²

τ and i_c²

τ at the same time. In an ideal error-free situation, the same bit interpretations ensue from both mean-square channel noise amplitudes. However the bit interpretations can differ when there are errors, because the current and voltage amplitudes are statistically independent due to Gaussianity and the Second Law of Thermodynamics.^1-6 To eliminate errors, we keep only those cases where both the current and voltage methods interpret 01/10 bit values.

Table 2 illustrates this situation.⁴

Table 2 KLJN error removal method with combined current and voltage analysis. Voltage measurement interpretation

00 11 01/10

Current measurement interpretation

00 00

(Insecure/Discard)

Discard (check attack)

00 (Insecure/Discard) 11

Discard (check attack)

11 (Insecure/

Discard)

11 (Insecure/

Discard)

01/10 00

(Insecure/

Discard)

11 (Insecure/

Discard)

01/10 (Secure)

Due to their independence, the error probabilities in the combined current-voltage method are the product of the error probabilities of the current-based and voltage-based schemes.⁴ The resultant probabilities ε_t_,00 and ε_t_,11 of 00==>01/10 and 11==>01/10types of errors are⁴

2 2

,00 00 ,00

1 ( )

3exp 4

t i

γ β ρ

ε =ε ε = ^⁻ ⁺ ^

 , for 0<β <1 and 0<ρ <1, (9)

2 2

,11 11 ,11

1 ( )

3exp 4

t i

γ δ λ

ε =ε ε = ^⁻ ⁺ ^

 , for 0< <δ 1 and 0< <λ 1, (10) respectively.

These error probabilities are again exponential functions of the parameter γ. For the practical parameters γ =100 and β ρ= =0.5 we find that ε_t_,00=1.24 10× ⁻⁶, which is drastically less than with the former methods. If the duration of the bit exchange period, i.e., γ , is increased by a factor of two, the total bit error probability ε_t_,00 is decreased to

12 ,00 4.6 10

εt ≈ × ⁻ . Similar improvements can be found for ε_t_,11

.

(8)

Although in the experimental setup presented in Ref. 9 we used a slightly modified decision table, the joint use of voltage and current detection had already been found suitable for decreasing error ratios. In addition, the results presented in current article are in good agreement with the experimental results.

3. Conclusion

This paper has classified and analyzed the types of errors in the KLJN key exchange for both voltage-based and current-based schemes. These error probabilities showed an exponential dependence on the duration of the bit exchange. Furthermore, we presented an enhanced error mitigation method, based on the combination of the voltage-based and current-based schemes, which operates without any error correction algorithm.

Acknowledgments

Y. Saez is grateful to IFARHU/SENACYT for supporting her PhD studies at Texas A&M. R. Mingesz’s contribution is supported by the European Union and the European Social Fund. Project #TÁMOP-4.2.2.A-11/1/KONV-2012-0073.

References

1. D. Abbott, G. Schmera, Scholarpedia 8 (8), 31157 (2013).

2. L.B. Kish, Physics Letters A 352, 178 (2006).

3. Y. Saez, L.B. Kish, PLoS ONE 8(11): e81103 (2013).

4. Y. Saez, L.B. Kish, R. Mingesz, Z. Gingl, C.G. Granqvist, Journal of Computational Electronics, DOI: 10.1007/s10825-013-0515-2 (2013).

5. R. Mingesz, L.B. Kish, Z. Gingl, C.G. Granqvist, H. Wen, F. Peper, T. Eubanks, G. Schmera, Metrology and Measurement Systems 20, 3 (2013).

6. L.B. Kish, D. Abbott, C.G. Granqvist. Critical analysis of the Bennett–Riedel attack on secure cryptographic key distributions via the Kirchhoff-law–Johnson-noise scheme. viXra preprint viXra:1306.0058; arXiv preprint arXiv:1306.653 (2013).

7. L.B. Kish, Fluctuations and Noise Letters 6, L57 (2005).

8. L.B. Kish, Metrology and Measurement Systems 20, 191 (2013).

9. R. Mingesz, L.B. Kish, Z. Gingl, Physics Letters A 372, 978 (2008).

10. L.B. Kish, R. Mingesz, Z. Gingl, C.G. Granqvist, Metrology and Measurement Systems 19, 653 (2012).

11. S.O. Rice, Bell System Technical Journal 23, 282 (1944).

12. I. Rychlik, Extremes 3, 331 (2000).